https://vulnogram.org/ Most recent CVEs assigned by QNAP Systems, Inc. (qnap). https://vulnogram.org/seaview/icons/qnap.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-50619 https://vulnogram.org/CVE-2026-50619 A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:… Critical Network Exploitable Thu, 15 Oct 2026 09:38:29 GMT https://vulnogram.org/CVE-2026-47790 https://vulnogram.org/CVE-2026-47790 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the followin… Medium Thu, 15 Oct 2026 09:38:20 GMT https://vulnogram.org/CVE-2026-47786 https://vulnogram.org/CVE-2026-47786 An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Hybrid… Critical Network Exploitable Thu, 15 Oct 2026 09:38:12 GMT https://vulnogram.org/CVE-2026-39997 https://vulnogram.org/CVE-2026-39997 A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the fol… High Thu, 15 Oct 2026 09:38:02 GMT https://vulnogram.org/CVE-2026-39991 https://vulnogram.org/CVE-2026-39991 A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the follow… Medium Thu, 15 Oct 2026 09:37:51 GMT https://vulnogram.org/CVE-2026-34009 https://vulnogram.org/CVE-2026-34009 An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have alr… High Thu, 15 Oct 2026 09:37:38 GMT https://vulnogram.org/CVE-2026-34008 https://vulnogram.org/CVE-2026-34008 An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have al… High Thu, 15 Oct 2026 09:37:29 GMT https://vulnogram.org/CVE-2026-34007 https://vulnogram.org/CVE-2026-34007 An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Sta… Medium Network Exploitable Thu, 15 Oct 2026 09:37:20 GMT https://vulnogram.org/CVE-2026-53882 https://vulnogram.org/CVE-2026-53882 An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the s… High Thu, 15 Oct 2026 09:31:51 GMT https://vulnogram.org/CVE-2026-50612 https://vulnogram.org/CVE-2026-50612 An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulner… Critical Thu, 15 Oct 2026 09:31:41 GMT https://vulnogram.org/CVE-2026-44084 https://vulnogram.org/CVE-2026-44084 An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the followi… High Network Exploitable Thu, 15 Oct 2026 09:31:29 GMT https://vulnogram.org/CVE-2026-41545 https://vulnogram.org/CVE-2026-41545 A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed t… High Thu, 15 Oct 2026 09:31:05 GMT https://vulnogram.org/CVE-2026-41541 https://vulnogram.org/CVE-2026-41541 An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the… Medium Thu, 15 Oct 2026 09:30:51 GMT https://vulnogram.org/CVE-2026-39989 https://vulnogram.org/CVE-2026-39989 A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in t… Medium Thu, 15 Oct 2026 09:30:42 GMT https://vulnogram.org/CVE-2026-34015 https://vulnogram.org/CVE-2026-34015 A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerabil… High Thu, 15 Oct 2026 09:30:31 GMT https://vulnogram.org/CVE-2026-34014 https://vulnogram.org/CVE-2026-34014 An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.… High Thu, 15 Oct 2026 09:30:12 GMT https://vulnogram.org/CVE-2026-34006 https://vulnogram.org/CVE-2026-34006 A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the follo… Critical Network Exploitable Thu, 15 Oct 2026 09:30:03 GMT https://vulnogram.org/CVE-2026-26245 https://vulnogram.org/CVE-2026-26245 A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the follo… High Thu, 15 Oct 2026 09:29:45 GMT https://vulnogram.org/CVE-2026-26244 https://vulnogram.org/CVE-2026-26244 A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the follo… High Thu, 15 Oct 2026 09:29:36 GMT https://vulnogram.org/CVE-2026-26243 https://vulnogram.org/CVE-2026-26243 A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerabil… High Thu, 15 Oct 2026 09:29:27 GMT https://vulnogram.org/CVE-2026-41544 https://vulnogram.org/CVE-2026-41544 A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability… High Thu, 15 Oct 2026 07:00:14 GMT https://vulnogram.org/CVE-2026-39993 https://vulnogram.org/CVE-2026-39993 A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th… High Thu, 15 Oct 2026 07:00:00 GMT https://vulnogram.org/CVE-2026-24723 https://vulnogram.org/CVE-2026-24723 A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerabilit… Medium Thu, 15 Oct 2026 06:59:47 GMT https://vulnogram.org/CVE-2026-24722 https://vulnogram.org/CVE-2026-24722 A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerabilit… Medium Thu, 15 Oct 2026 06:59:35 GMT https://vulnogram.org/CVE-2026-24721 https://vulnogram.org/CVE-2026-24721 A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerabilit… Medium Thu, 15 Oct 2026 06:59:20 GMT https://vulnogram.org/CVE-2026-24718 https://vulnogram.org/CVE-2026-24718 A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerabil… Medium Thu, 15 Oct 2026 06:59:06 GMT https://vulnogram.org/CVE-2026-24715 https://vulnogram.org/CVE-2026-24715 An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7… Medium Thu, 15 Oct 2026 06:58:49 GMT https://vulnogram.org/CVE-2026-22896 https://vulnogram.org/CVE-2026-22896 A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerab… Medium Thu, 15 Oct 2026 06:58:38 GMT https://vulnogram.org/CVE-2025-68404 https://vulnogram.org/CVE-2025-68404 A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in… High Thu, 15 Oct 2026 06:58:27 GMT https://vulnogram.org/CVE-2025-68403 https://vulnogram.org/CVE-2025-68403 An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed… Medium Thu, 15 Oct 2026 06:58:16 GMT https://vulnogram.org/CVE-2025-66275 https://vulnogram.org/CVE-2025-66275 A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerabil… High Thu, 15 Oct 2026 06:58:02 GMT https://vulnogram.org/CVE-2025-66272 https://vulnogram.org/CVE-2025-66272 A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerabil… High Thu, 15 Oct 2026 06:57:51 GMT https://vulnogram.org/CVE-2025-29897 https://vulnogram.org/CVE-2025-29897 A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vu… Low Thu, 15 Oct 2026 06:57:40 GMT https://vulnogram.org/CVE-2025-29896 https://vulnogram.org/CVE-2025-29896 A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability… Low Thu, 15 Oct 2026 06:57:26 GMT https://vulnogram.org/CVE-2025-29895 https://vulnogram.org/CVE-2025-29895 A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability… Low Thu, 15 Oct 2026 06:57:13 GMT https://vulnogram.org/CVE-2024-38639 https://vulnogram.org/CVE-2024-38639 An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the follow… Medium Network Exploitable Fri, 18 Sep 2026 06:51:06 GMT https://vulnogram.org/CVE-2024-27123 https://vulnogram.org/CVE-2024-27123 A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following… Medium Fri, 18 Sep 2026 06:49:37 GMT https://vulnogram.org/CVE-2026-26240 https://vulnogram.org/CVE-2026-26240 A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5… Low Network Exploitable Wed, 10 Jun 2026 05:03:37 GMT https://vulnogram.org/CVE-2026-26241 https://vulnogram.org/CVE-2026-26241 A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5… Low Network Exploitable Wed, 10 Jun 2026 05:02:29 GMT https://vulnogram.org/CVE-2026-24724 https://vulnogram.org/CVE-2026-24724 An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in… Medium Wed, 10 Jun 2026 03:15:27 GMT https://vulnogram.org/CVE-2026-26239 https://vulnogram.org/CVE-2026-26239 A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the followi… Medium Wed, 10 Jun 2026 03:15:18 GMT https://vulnogram.org/CVE-2026-26237 https://vulnogram.org/CVE-2026-26237 A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following v… Medium Network Exploitable Wed, 10 Jun 2026 03:15:03 GMT https://vulnogram.org/CVE-2026-24719 https://vulnogram.org/CVE-2026-24719 A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed th… Medium Wed, 10 Jun 2026 03:14:52 GMT https://vulnogram.org/CVE-2026-24717 https://vulnogram.org/CVE-2026-24717 A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. W… Low Wed, 10 Jun 2026 03:14:46 GMT https://vulnogram.org/CVE-2026-24716 https://vulnogram.org/CVE-2026-24716 A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We h… Low Wed, 10 Jun 2026 03:08:55 GMT https://vulnogram.org/CVE-2026-24720 https://vulnogram.org/CVE-2026-24720 An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes… Low Wed, 10 Jun 2026 03:08:09 GMT https://vulnogram.org/CVE-2026-22899 https://vulnogram.org/CVE-2026-22899 A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerabilit… Low Wed, 10 Jun 2026 03:07:48 GMT https://vulnogram.org/CVE-2026-22893 https://vulnogram.org/CVE-2026-22893 A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed th… High Wed, 10 Jun 2026 03:06:34 GMT https://vulnogram.org/CVE-2025-66281 https://vulnogram.org/CVE-2025-66281 A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability i… Medium Network Exploitable Wed, 10 Jun 2026 03:06:06 GMT https://vulnogram.org/CVE-2025-66280 https://vulnogram.org/CVE-2025-66280 An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.… Medium Wed, 10 Jun 2026 03:05:59 GMT